Ethereal-users: Re: [Ethereal-users] Creating a dissector

Note: This archive is from the project's previous web site, ethereal.com. This list is no longer active.

From: Guy Harris <guy@xxxxxxxxxx>
Date: Fri, 6 Dec 2002 12:07:05 -0800
On Fri, Dec 06, 2002 at 08:08:45AM -0500, Parks, Chauni wrote:
> I wrote a dissector for a protocol to run atop TCP. I then made it as a
> plugin. I followed the procedures to insure my plugin was installed in all
> the Makefiles and configure.in file. I am able to see my plugin listed in
> the plugin pulled down.

Well, that means that Ethereal is definitely finding your plugin.

> However, once I run ethereal I can't seem to find it
> once I capture data. I am executing data that the plugin should capture.

How is the plugin dissector registering itself with the TCP dissector? 
Is it using

	dissector_add("tcp.port", {port number}, {handle});

in which case it should be used for all TCP traffic to or from the port
number in question and no other traffic, or is it a heuristic dissector
registered with

	heur_dissector_add("tcp", {dissector}, {protocol ID});

in which case it should be used for TCP traffic for which that heuristic
works and no other heuristics work?